1. Field
The present invention relates to a performance abnormality analysis apparatus, a performance abnormality analysis method, and a performance abnormality analysis program, and an analysis result display method for the performance abnormality analysis apparatus, which, for example, in an complicated network system such as a plural-layer server system, by analyzing and clarifying the generation pattern of a performance abnormality, assists specifying the cause at an early stage or resolving an abnormality at an early stage with respect to the performance abnormality.
2. Description of the Related Art
Conventionally, several methods to analyze the cause of a performance abnormality of a system have been researched. In the following Non-Patent Document 1, there is employed a method in which a measurement means called an event tracer is embedded in a kernel of a Linux, and the utilization situation of a resource is directly observed, and the analysis for the behavior thereof is performed. This method, which directly collects more detailed data, is significantly effective in an environment such as a benchmark testing of a system.
However, in a system which is being operated, it is significantly difficult to embed a measurement means in a kernel. Furthermore, this means is applied only to an open-source OS.
Furthermore, in the following Non-Patent Document 2, “automated drill down” is suggested as a method for the system performance analysis. This method performs an analysis with the grain size, under which parameters are observed, changed such that hour→minute, subnet→host, and a grain size under which the ratio of the performance abnormality is large is found out.
However, when this method is employed, with respect to parameters which are represented as consecutive amounts such as resource consumption amounts, it is difficult to analyze parameters whose grain size cannot be set up. Accordingly, since parameters which can be used for the analysis are extremely limited, it is difficult to apply this method to the analysis for multiple numerical value parameters, which is the object of the present invention.
As a method for a bottleneck analysis which utilizes a decision tree, in the Non-Patent Document 3, using an open-source data mining tool (Weka 3: Data Mining Software in Java, <http://www.cs.waikato.ac.nz/ml/weka/>), a bottleneck raised in an eBay of an auction site is analyzed. However, in an environment of this method, the number of kinds of parameters to be used for the analysis is only six, which is all discrete information such as the type of request or the host name, and is not numerical value information. So, the upper limit of the number of value to which respective parameters can be set is extremely limited. Then, while the analysis is performed about which apparatus in a system is the cause of a bottleneck, it cannot be seen that under what state (range of value of parameters) of the apparatus a bottleneck occurs.
Furthermore, in this method, a decision tree is generated using an existing method such as the “C4.5” (method which has an algorithm based on the divide and conquer algorithm, and establishes a tree by recursively invoking a function to establish respective nodes, and, from data which establishes the tree, acquires divisional information in the respective nodes to select attributes to be divided) or the “MinEntropy”.    Non-Patent Document 1: T. Horikawa, Application of Event Trace Framework for Performance Problem Solutions, IPSJ SIG Technical Report, 2003.    Non-Patent Document 2: D. G. Hart, J. L. Hellerstein, and P. C. Yue, Failure Diagnosis Using Detection Trees Automated Drill Down: An Approach to Automated Problem Isolation for Performance Management, Proc. of the Computer Measurement Group, 1999.    Non-Patent Document 3: M. Chen, A. X. Zheng, J. Lloyd, M. I. Jordan, and E. Brewer, Failure Diagnosis Using Detection Trees, Proc. of International Conference on Automatic Computing, 2004.